tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Give editors a new session id when they log in.

Browse Source
This commit is contained in:
tim
2026-09-25 21:39:06 +02:00
parent 41c46a43c6
commit 36c7fe97c5
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/login.php
+1 -1
View File
@@ -32,7 +32,7 @@ if (isset($_SESSION['editor'])) {
if (!password_verify($compare_password, $stored_password)) { if (!password_verify($compare_password, $stored_password)) {
$denied = TRUE; $denied = TRUE;
} else { } else {
$_SESSION['editor'] = $username; login_editor($username);
// Keep user logged in with cookie, if they request it // Keep user logged in with cookie, if they request it
if (isset($_POST['remember'])) { if (isset($_POST['remember'])) {
create_persistent_login($username); create_persistent_login($username);
session.lib.php
+11 -1
View File
@@ -46,7 +46,7 @@ function check_persistent_login() {
$stored_session = $row['session']; $stored_session = $row['session'];
if ($stored_session == $key) { if ($stored_session == $key) {
// login // login
$_SESSION['editor'] = $username; login_editor($username);
// delete cookie // delete cookie
delete_persistent_login(); delete_persistent_login();
// create new cookie // create new cookie
@@ -122,3 +122,13 @@ function csrf_valid($token = NULL) {
return is_string($token) && isset($_SESSION['csrf_token']) && return is_string($token) && isset($_SESSION['csrf_token']) &&
hash_equals((string)$_SESSION['csrf_token'], $token); hash_equals((string)$_SESSION['csrf_token'], $token);
} }
/*
* Log an editor in under a new session id, so that a session id that
* someone planted or saw before the login is of no use afterwards.
*/
function login_editor($username) {
session_regenerate_id(TRUE);
unset($_SESSION['csrf_token']);
$_SESSION['editor'] = $username;
}